CVE-2026-18569: Keycloak Auth Bypass Vulnerability

CVE-2026-18569 Overview

CVE-2026-18569 affects the backchannel logout endpoint in the keycloak-services component of the Red Hat Build of Keycloak. The component handles authentication and session management for downstream applications. The flaw activates when an OpenID Connect (OIDC) identity provider is configured to skip signature validation. In that configuration, the endpoint accepts logout requests that carry no cryptographic signature. An attacker who knows specific session details can force a targeted user to be logged out, disrupting active work sessions. The issue is tracked under [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Unauthenticated attackers with knowledge of session identifiers can trigger forced logouts against Keycloak users when signature validation is disabled on the OIDC identity provider.

Affected Products

Red Hat Build of Keycloak
keycloak-services component (backchannel logout endpoint)
Deployments configured with an OIDC identity provider that skips signature validation

Discovery Timeline

2026-08-04 - CVE-2026-18569 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18569

Vulnerability Analysis

The vulnerability resides in the backchannel logout handling logic within keycloak-services. Backchannel logout is an OIDC mechanism that allows an identity provider to notify relying parties that a user's session has ended. The specification requires the logout token to be signed so the receiver can verify its origin.

When an administrator configures the Keycloak OIDC identity provider to skip signature validation, the backchannel logout endpoint proceeds without verifying that a logout token is signed. It accepts requests that contain no cryptographic signature at all, rather than rejecting them. This behavior violates the integrity expectations of the OIDC backchannel logout flow.

The attacker must know technical details about the target session, which raises the attack complexity. Successful abuse invalidates the victim's session and produces a limited availability impact. Confidentiality and integrity of session data are not directly affected.

Root Cause

The root cause is improper verification of a cryptographic signature on inbound logout tokens. The endpoint conflates "skip signature validation" with "accept unsigned tokens." A safer implementation would still require a signature to be present and structurally valid, even when advanced key-based verification is bypassed.

Attack Vector

Exploitation occurs over the network against the Keycloak backchannel logout endpoint. The attacker crafts an unsigned logout request that references a known session identifier or subject. The endpoint accepts the request and terminates the corresponding session. No authentication or user interaction is required, but session-specific knowledge is a prerequisite.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-18569 Advisory and Red Hat Bug Report #2509755 for vendor technical detail.

Detection Methods for CVE-2026-18569

Indicators of Compromise

Backchannel logout requests to /broker/{provider}/endpoint/backchannel_logout that lack a signed logout_token JWT or contain a token with an empty signature segment.
Unexpected session termination events in Keycloak audit logs without a corresponding user-initiated logout.
Repeated logout requests targeting the same subject or session identifier from a single source address.

Detection Strategies

Review Keycloak event logs for LOGOUT and CLIENT_LOGOUT events that do not correlate with user activity on the front channel.
Inspect reverse proxy or ingress logs for POST requests to backchannel logout URIs that originate from addresses outside the expected identity provider ranges.
Alert on any Keycloak realm where an OIDC identity provider has validateSignature disabled, and correlate with inbound logout traffic.

Monitoring Recommendations

Forward Keycloak EVENT and ADMIN_EVENT streams into a centralized log store for long-term correlation.
Track configuration drift on identity provider objects, specifically the signature validation flag, and alert on changes.
Baseline normal backchannel logout volume per identity provider and alert on deviations.

How to Mitigate CVE-2026-18569

Immediate Actions Required

Enable signature validation on every configured OIDC identity provider in Keycloak realms.
Restrict network access to the backchannel logout endpoint so only the trusted identity provider can reach it.
Audit realm configurations for identity providers with validateSignature set to false and remediate them.

Patch Information

Refer to the Red Hat CVE-2026-18569 Advisory for fixed package versions of the Red Hat Build of Keycloak. Track remediation progress through Red Hat Bug Report #2509755.

Workarounds

Re-enable signature validation on OIDC identity providers until patched builds are deployed.
Place the Keycloak backchannel logout endpoint behind an allowlist that only permits traffic from the upstream identity provider.
Rotate signing keys on the upstream identity provider and require signed logout tokens end-to-end.

bash

# Configuration example: enforce signature validation on an OIDC identity provider via kcadm
kcadm.sh update identity-provider/instances/<alias> \
  -r <realm> \
  -s 'config.validateSignature="true"' \
  -s 'config.useJwksUrl="true"' \
  -s 'config.jwksUrl="https://idp.example.com/.well-known/jwks.json"'